diff --git a/server/red-qxl.c b/server/red-qxl.c
index e145ea49..6ad8f6a5 100644
--- a/server/red-qxl.c
+++ b/server/red-qxl.c
@@ -130,7 +130,7 @@ static void red_qxl_display_migrate(RedChannelClient *rcc)
     g_object_get(channel, "channel-type", &type, "id", &id, NULL);
     dispatcher = (Dispatcher *)g_object_get_data(G_OBJECT(channel), "dispatcher");
     spice_printerr("channel type %u id %u", type, id);
-    payload.rcc = rcc;
+    payload.rcc = g_object_ref(rcc);
     dispatcher_send_message(dispatcher,
                             RED_WORKER_MESSAGE_DISPLAY_MIGRATE,
                             &payload);
@@ -187,7 +187,7 @@ static void red_qxl_cursor_migrate(RedChannelClient *rcc)
     g_object_get(channel, "channel-type", &type, "id", &id, NULL);
     dispatcher = (Dispatcher *)g_object_get_data(G_OBJECT(channel), "dispatcher");
     spice_printerr("channel type %u id %u", type, id);
-    payload.rcc = rcc;
+    payload.rcc = g_object_ref(rcc);
     dispatcher_send_message(dispatcher,
                             RED_WORKER_MESSAGE_CURSOR_MIGRATE,
                             &payload);
diff --git a/server/red-worker.c b/server/red-worker.c
index 6ebe6b94..9c97f499 100644
--- a/server/red-worker.c
+++ b/server/red-worker.c
@@ -747,6 +747,7 @@ static void handle_dev_display_migrate(void *opaque, void *payload)
     spice_debug("migrate display client");
     spice_assert(rcc);
     red_migrate_display(worker->display_channel, rcc);
+    g_object_unref(rcc);
 }
 
 static inline uint32_t qxl_monitors_config_size(uint32_t heads)
@@ -828,6 +829,7 @@ static void handle_dev_cursor_migrate(void *opaque, void *payload)
 
     spice_debug("migrate cursor client");
     cursor_channel_client_migrate(rcc);
+    g_object_unref(rcc);
 }
 
 static void handle_dev_set_compression(void *opaque, void *payload)